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DETAILED ACTION 

1. This is in response to the Reply and Remarks filed on 1/10/2005. Claim 34 is 
further canceled. Claims 1-8 and 13-33 are presented for examination. 



Claim Rejections - 35 USC § 102 

2. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under 
section 122(b), by another filed in the United States before the invention by the 
applicant for patent or (2) a patent granted on an application for patent by 
another filed in the United States before the invention by the applicant for patent, 
except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application 
filed in the United States only if the international application designated the 
United States and was published under Article 21(2) of such treaty in the English 
language. 

3. Claims 1-8 and 13-24 are rejected under 35 U.S.C. 102(e) as being anticipated 
by Giroir et al M (hereafter Giroir), U.S. pat. No.6,760,771 . 

As to claim 1 , Giroir discloses a communication switch comprising: 

at least one input (input/IP datagram sent from client 501 fig.5) for receiving 

messages, each message including, 

an address specifier and a port specifier (using IP datagram including source 

and destination port, seefig.3, col. 5 line 57 to col. 6 line 41). 

a traffic analyzer (DT traffic analyzer 51 1 fig.5) to compare the port specifier of 

a first message against the port specifiers of previously received messages and an 
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output for reporting a result of the comparison to a remote location (server 503 fig.5) 
(see col.7 line 24 to col.8 line 43 and col. 10 lines 13-65). 

As to claims 2 and 3, Giroir discloses a usage tracking system to throttle traffic through 
the communication switch and means to throttle traffic based on a number of messages 
having the same address specifier and port specifier (see col. 10 line 45 to col. 11 line 
57 and col. 12 lines 30-64). 

As to claims 4 and 5, Giroir discloses the usage tracking system includes means to 
throttle traffic according to a predetermined maximum aggregate bandwidth for the 
communication switch and reporting fraud over the output (using capacity of servers, 
see col.9 lines 30-51, coi.10 line 45 to col. 11 line 57 and col. 12 lines 30-64). 

As to claim 6, Giroir discloses the traffic analyzer to comparing the address specifier 
and port specifier combination of the first message against the address specifier and 
port specifier combinations of the previously received messages (see col.9 lines 30-51 
and col. 12 lines 30-64). 

As to claim 7, Giroir discloses that each message further includes, traffic type specifier; 
and the traffic analyzer is further to compare the traffic type specifier of the first 
message against the traffic type specifiers of the previously received messages (see 
fig.5, col. 10 line 45 to col. 11 line 57 and col. 12 lines 30-64). 
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As to claim 8, Giroir discloses each message further includes a traffic type specifier and 
the traffic analyzer is further for comparing the address specifier, port specifier, and 
traffic type specifier of the first message against address specifier, port specifier, and 
traffic type specifier combinations of the previously received messages and to report 
information to the remote location regarding a combination of request types originating 
from the same address specifier and port specifier (see fig.6, col.8 line 44 to col.9 line 
51 and and col. 12 lines 30-64). 

As to claim 13, Giroir discloses a method comprising: 

receiving a first message which includes an address:port identifier (using IP 
datagram including source and destination port, see fig.3, col. 5 line 57 to col.6 line 41 ). 

comparing the address:port identifier against previously received messages 1 
address:port identifiers (using DT traffic analyzer 51 1 fig.5) and determining whether 
excessive traffic is originating from a source identified by a common address:port 
identifier of the first message and at least some of previously received messages (see 
fig.5, col.7 line 24 to col.8 line 43 and col. 10 lines 13-65). 

As to claims 14 and 15, Giroir discloses throttling message traffic in response to 
determining that excessive traffic is originating from the source and throttling message 
traffic to and/or from the source (see fig.5, col. 10 line 45 to col.11 line 57 and col. 12 
lines 30-64). 
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As to claim 16, Giroir discloses comparing the type specifier against type specifiers of 
previously received messages having the same address:port as the first message and 
determining whether the source is issuing messages of different types (see col. 9 lines 
30-51 and col. 12 lines 30-64). 

As to claims 17 and 18, Giroir discloses sending a fraud alert in response to determining 
that the source is issuing messages of different types such as indicate fraud and 
recording the message for use in future comparisons against future messages (see 
col. 10 line 45 to col. 11 line 57 and col.12 lines 30-64). 

As to claim 19, Giroir discloses receiving an indication of a maximum bandwidth and 
throttling message traffic in response to the indication of the maximum bandwidth (using 
capacity of servers, see col.9 lines 30-51, col. 10 line 45 to col. 11 line 57 and col.12 
lines 30-64). 

As to claim 20, Giroir discloses a customer premises gateway comprising: 

at least one first Input/Output I/O (router 515 fig.5) each to connect to a 
communication device and a second I/O for connecting to the Internet Service Provider 
ISP premises head-end server (503 fig.5) (using IP datagram including source and 
destination port, see fig.3, col.5 line 57 to col.6 line 41); and 
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a traffic analyzer (51 1 fig.5) coupled to the at least one first 1/0 and the second 
I/O, including a port identifier comparator, a throttling mechanism, and a fraud reporter 
(see fig.5, col.7 line 24 to col. 8 line 43 and col. 10 lines 13-65). 

As to claim 21 , Giroir discloses a message type analyzer (see fig.5, col.7 line 24 to col.8 
line 43 and col.10 lines 13-65). 

As to claim 22, Giroir discloses a machine accessible medium including instructions 
which, when executed by the machine, cause the machine to: 

compare a first address:port combination of a message against a second 
address:port combination of a previously received message see fig.3, col .5 line 57 to 
col.6 line 41) and responsive to the address:port comparison, determine whether 
excessive traffic is going to/from the first address:port combination (see fig.5, col.7 line 
24 to col.8 line 43 and col.10 lines 13-65). 

As to claim 23, Giroir discloses throttling traffic to/from the first address:port 
combination and report fraud (see col. 12 lines 20-58 and col. 14 lines 1 3-65). 

As to claim 24, Giroir discloses comparing a first type specifier of the message against a 
second type specifier of the previously received message and responsive to the type 
specifier comparison (see fig.5, col.7 line 24 to col.8 line 43 and col.10 lines 13-65). 
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Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed 
or described as set forth in section 102 of this title, if the differences between the 
subject matter sought to be patented and the prior art are such that the subject 
matter as a whole would have been obvious at the time the invention was made 
to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was 
made. 

This application currently names joint inventors. In considering patentability of the 
claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of the 
various claims was commonly owned at the time any inventions covered therein were 
made absent any evidence to the contrary. Applicant is advised of the obligation under 
37 CFR 1.56 to point out the inventor and invention dates of each claim that was not 
commonly owned at the time a later invention was made in order for the examiner to 
consider the applicability of 35 U.S.C. 103(c) and potential 35 U.S.C. 102(e), (f) or (g) 
prior art under 35 U.S.C. 103(a). 

5. Claims 25-33 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Giroirin view of Sigaud (hereafter Sigaud), U.S. pat. No.6,657,956. 

As to claims 25 and 26, Giroir's teachings still applied as in item 3 above. Giroir does 
not specifically disclose masquerading port information and reporting the masquerading. 
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However, Sigaud discloses disclose masquerading port information in IP environment 
and report the masquerading (preventing a hacker from connecting at a given moment 
by masquerading as someone else at the terminal connected to the IP network, see 
fig.2, col.4 line 60 to col.5 line 65). It would have been obvious to one of the ordinary 
skill in the art at the time the invention was made to incorporate Sigaud's teachings into 
the computer system of Giroir to protect data information because it would have 
protected a stations' access to at least one server and provided selection access to the 
application requested from the server in a communications network. 

As to claim 27, Giroir discloses a method for a communication switch to detect that a 
device connected to the communication switch is a router, comprising: 

receiving in a communication switch a message from a device (client 501 fig.5), 
the message including address and sub-address identifiers (using IP datagram 
including source and destination port, see fig.3, col.5 line 57 to col .6 line 41). 

comparing the address and sub-address identifiers against one or more 
previously received 

messages (see fig.5, col. 7 line 24 to col. 8 line 43 and col. 10 lines 13-65). 
Giroir does not specifically disclose determining whether the device is performing 
masquerading. However, Sigaud discloses disclose determining whether the device is 
performing masquerading (preventing a hacker from connecting at a given moment by 
masquerading as someone else at the terminal connected to the IP network, see fig.2, 
col.4 line 60 to col.5 line 65). It would have been obvious to one of the ordinary skill in 
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the art at the time the invention was made to incorporate Sigaud's teachings into the 
computer system of Giroir to protect data information because it would have protected a 
stations' access to at least one server and provided selection access to the application 
requested from the server in a communications network. 

As to claims 28 and 29, Giroir discloses observing a first message type indicator in the 
message and a different message type indicator in at least one of the previously 
received messages and recording the address and sub-address identifiers of the 
message, receiving a second message and comparing the second message's address 
and sub-address identifiers against the recorded address and sub-address identifiers 
(see col. 12 lines 20-58 and col. 14 lines 13-65). 

As to claim 30, Giroir discloses the address identifier comprises an Internet Protocol 
address and the sub-address identifier comprises a port number (see col. 12 lines 20-58 
and col. 14 lines 13-65). 

As to claim 31, Giroir discloses sending a fraud alert to a server (see col. 12 lines 20-58 
and col. 14 lines 13-65). Giroir does not specifically disclose determining whether the 
device to perform masquerading. However, Sigaud discloses disclose determining 
whether the device to perform masquerading (preventing a hacker from connecting at a 
given moment by masquerading as someone else at the terminal connected to the IP 
network, see fig.2, col .4 line 60 to col .5 line 65). It would have been obvious to one of 
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the ordinary skill in the art at the time the invention was made to incorporate Sigaud's 
teachings into the computer system of Giroir to protect data information because it 
would have protected a stations' access to at least one server and provided selection 
access to the application requested from the server in a communications network. 

As to claims 32 and 33, Giroir discloses throttling message transmission, comparing a 
message type identifier of the message against one or more previously received 
messages and detecting that the message type identifier of the message is different 
than a message type identifier of a previously received message having a same 
address identifier and a same sub-address identifier as the message (see col. 10 line 45 
to col. 11 line 57 and col. 12 lines 30-64). Giroir does not specifically disclose 
determining whether the device to perform masquerading. However, Sigaud discloses 
disclose determining whether the device to perform masquerading (preventing a hacker 
from connecting at a given moment by masquerading as someone else at the terminal 
connected to the IP network, see fig.2, col .4 line 60 to col. 5 line 65). It would have 
been obvious to one of the ordinary skill in the art at the time the invention was made to 
incorporate Sigaud's teachings into the computer system of Giroir to protect data 
information because it would have protected a stations 1 access to at least one server 
and provided selection access to the application requested from the server in a 
communications network. 
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Response to Arguments 

6. Applicant's arguments with respect to claims 1 -8 and 1 3-33 have been 
considered but are moot in view of the new ground(s) of rejection. 

Other prior art cited 

7. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

a. Schweitzer et al, US pat. No.6,61 5,262. 

Conclusion 

8. Claims 1-8 and 13-33 are rejected. 

9. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Khanh Dinh whose telephone number is (571) 272- 
3936. The examiner can normally be reached on Monday through Friday from 8:00 A.m. 
to 5:00 P.m. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Zarni Maung, can be reached on (571 ) 272-3939. The fax phone number 
for this group is (571 ) 273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
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more information about the PAIR system, see http://pair-direct.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-217-9197 (toll-free). 



Khanh Dinh 
Patent Examiner 
Art Unit 21 51 
7/24/2005 



